Falhas do tipo CWE-184

242 resultados

Lista incompleta de entradas bloqueadas

Quando um aplicativo tenta bloquear entradas perigosas (como caracteres especiais, palavras-chave ou padrões maliciosos), mas a lista de bloqueio é incompleta ou mal pensada, um atacante consegue contornar a proteção usando variações não previstas. É a falsa sensação de segurança: o desenvolvedor acredita estar protegido, mas deixa brechas.

Exemplo

Um formulário web bloqueia a palavra 'script' para evitar XSS, mas não bloqueia 'sCrIpT' com letras maiúsculas, ou '\x3cscript' em hexadecimal. Um atacante injeta uma dessas variações e consegue executar JavaScript malicioso, burlando a proteção.

Como mitigar

Em vez de manter listas de bloqueio (blacklist), use whitelist: aceite apenas entradas conhecidas como seguras, validate com regex rigorosa e, quando possível, escape ou sanitize output com bibliotecas consolidadas (DOMPurify, OWASP, etc). Prefira validação estruturada sobre verificações ad-hoc.

CVE-2026-32940CRITICALSiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)EPSS 0.3%CVE-2026-115845MEDIUMIncomplete validation in the run_script Python sandbox in AWS MCP ServerEPSS 0.3%CVE-2026-84706HIGHAutomation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_env/ld_preload) allowing code execution in the execution environmentEPSS 0.3%CVE-2026-54070HIGHSiYuan: Stored XSS in Bazaar marketplace via package README event handlersEPSS 0.3%CVE-2026-105648MEDIUMGhost: Private IP Filtering Bypass via IPv6 Transition AddressesEPSS 0.3%CVE-2026-49825HIGHlxml: javascript: URL bypass in Cleaner via xlink:hrefEPSS 0.3%CVE-2026-4509MEDIUMPbootCMS File Upload file.php incomplete blacklistEPSS 0.3%CVE-2026-35000HIGHChangeDetection.io < 0.54.7 SafeXPath3Parser Bypass Arbitrary File ReadEPSS 0.3%CVE-2026-84714HIGHAutomation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fields, and host names, reaching ansible-core templating in the execution environmentEPSS 0.3%CVE-2026-42590HIGHGotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistEPSS 0.3%CVE-2026-43578CRITICALOpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Missed Async Exec Completion Events in Heartbeat Owner DowngradeEPSS 0.3%CVE-2026-55830HIGHRestrictedPython guard hooks can be shadowed via positional-only argumentsEPSS 0.3%CVE-2026-68921MEDIUMDiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)EPSS 0.3%CVE-2026-39315MEDIUMUnhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()EPSS 0.3%CVE-2025-58361CRITICALPromptcraft Forge Studio's incomplete URL check is vulnerable to XSS via SVGEPSS 0.3%CVE-2026-56547LOWAn input reflection vulnerability affects HCL TravelerEPSS 0.3%CVE-2026-63206MEDIUMZammad: Remote image tracking bypass via shortened URL schemeEPSS 0.3%CVE-2025-24388LOWUnsafe handling of AJAX callsEPSS 0.3%CVE-2025-67747HIGHFickling has missing detection for marshal.loads and types.FunctionType in unsafe modules listEPSS 0.3%CVE-2026-32022MEDIUMOpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy BypassEPSS 0.3%